Battle Against Ursnif Malspam
Campaign targeting JapanKen Sajo: JPCERT/CC
Yasuhiro Takeda: Mizuho Financial Group, Inc
Yusuke Niwa: Itochu Corporation.
ばらまきメール回収の会

Agenda1. Introduction
2. Abstraction of malspam
3. Threat Analysis with diamond model
4. Active Defense
5.Countermeasure against malspam
6. Summary2

1-1. Who we are▪ We are members of the community which called“ばらまきメール回収の会“ between individual researcher tracking malspam▪ This community is consist of CSIRT members at user side and security
researchers at vendor side

Motivation
In order to reduce damages by malspam in Japan
Avtivity Overview
The organization that receives the malspam quickly share information,
analyzes it together, and publicly sends out information necessary forcountermeasures.
3

Presenter’s account: @bomccss, @AIR3_ytakeda, @gorimpthon

1-2. Today’s topic

・Analysis of malspam campaign
・Analysis of threat actor
・Countermeasures against malspam
Especially we focus on Ursnif malspam campaign intoday’s presentation because this campaign has been themost major one since 20174

2. What is malspam?
Our definition of malspam
Email in Japanese delivered indiscriminately to Japanin order to infect malware.
*Malspam leads to infect malware by attachment files or suspicious link5

2-1. History of malspam inJapan
Malspam targeting to Japan

6

Year

Campaign

May. 2014

VAWTRAKOct. 2015

Shifu(AnglerEK)

Dec. 2015

BeblohMar. 2016 – Jun. 2019

UrsnifSep. 2019

EmotetOur investigation is based on data from 2016 - Current

Ursnif （a.k.a gozi, snifula, ISFB, Papras, Dreambot）▪

Banking Trojan▫ It appeared 2006 globally (Japan: 2016)▫ This malware steals financial accounts at online payment byinjecting fake page.
▫ Target is Financial companies account in Japan▫ This also steals credentials such as email and browser’s datain the host▪

7

Infection Route▫ Email▫ Web▫ Other malware

2.1. Delivery volume Japanese malspam
Monthly Trends
ばらまきメールの発生回数82.1. Delivery volume Japanese malspam

9

2.2. Ursnif malspams

10

2.2. Ursnif malspams

11

2.2. Ursnif malspam campaign targeting Japan
We classified 4 phases for this campaign overview until
fraud remittance
1. Delivery malspam
2. Ursnif download
3. Ursnif infection (delivery webconfig)
4. Fraud Remittance12

2.3 Overview of malspam campaign in Japan
Operation
CutWail
C2

CutWail

Ursnif
Steal
Information

Bank accountCredit card Info
Manipulation
Server13

Spam+
Downloader

Bank site etc.
Web Injection

WebConfig

Ursnif-C2

2.3 Overview of malspam campaign in Japan
Operation
CutWail
C2

CutWail

Spam+
Downloader

Steal
Information

1.Delivery malspam

Bank accountCredit card Info
Manipulation
Server14

UrsnifBank site etc.
Web Injection

WebConfig

Ursnif-C2

2.3 Overview of malspam campaign in Japan
2. Ursnif download

Operation
CutWail
C2

CutWail

Ursnif
Steal
Information

Bank accountCredit card Info
Manipulation
Server15

Spam+
Downloader

Bank site etc.
Web Injection

WebConfig

Ursnif-C2

2.3 Overview of malspam campaign in Japan
Operation
CutWail
C2

CutWail

Ursnif
Steal
Information

Bank accountCredit card Info
Manipulation
Server16

Spam+
Downloader

Bank site etc.
Web Injection

WebConfig

Ursnif-C2

3. Ursnif infection(Derivery webconfig)

2.3 Overview of malspam campaign in Japan
Operation
CutWail
C2

CutWail

Ursnif
Steal
Information

Bank accountCredit card Info
Manipulation
Server17

Spam+
Downloader

Bank site etc.

WebConfig

Web Injection
4. Fraud Remittance

Ursnif-C2

2.3 Overview of malspam campaign in Japan
2. Ursnif download

Operation
CutWail
C2

CutWail

Spam+
Downloader

Steal
Information

1.Delivery malspam

Bank accountCredit card Info
Manipulation
Server18

UrsnifBank site etc.
Web Injection

WebConfig

Ursnif-C2

3. Ursnif infection(Delivery webconfig)
4. Fraud Remittance2.4. Ursnif malspam campaign targeting Japan
We guess there are 2 threat actors targeting Japan basedon TTPs (Delivery method, Infection process, C2 domainetc.).
Group-A▪ Group-A utilizes attached xls files for Ursnif infection
Group-B▪ Group-B utilizes suspicious URLs for Ursnif infection
19

2.4. Ursnif malspams

20

Group-A

2.4. Ursnif malspams

21

Group-B

2.4. Analysis of Ursnif malspam campaign
Characteristics for each group

22

Classification

Group-A
Group-A

Group-B
Group-B

Emailcontents

Deceived Invoice email

Deceived EC / Bank email

Delivery
Route

Only Cutwail

Mainly Cutwail

Attachment
Files

xls with Macro(Multi obfuscation)

js file in link

MalwareBebloh + Ursnif(Gozi)

Ursnif(Dreambot)

Target3 banks*hard to confirm webconfig

30 banks, 9 credit card companies
and 8 cryptocurrency exchanges

3. Threat analysis for malspam campaign
TTPs and Threat Actor Analysis based on diamond model
Adversary

23-Target-Division of Role

Infrastructure

Capabilitiy-Spambot-C2-Maldoc-MalwareVictim -Botnet-Fraud remittance3.1. Delivery malspam
Each threat actor has own delivery method.
▪ Group-A▫ Cutwail-A▪ Group-B▫ Web (EK)
▫ Cutwail-A▫ Cutwail-B▫ Compromised Email Account▫ Reply Type▫ Emotet24

3.1. Delivery malspam
Each threat actor has own delivery method.
▪ Group-A▫ Cutwail-A▪ Group-B▫ Web (EK)
▫ Cutwail-A▫ Cutwail-B▫ Compromised Email Account▫ Reply Type▫ Emotet25

3.1.1. Cutwail
Spambot scatters malspam by threat actor’s order▪ 2 malwares for Japan have been observed below
We called
Older one : Cutwail-A
Newer one : Cutwail-B
Each Cutwail communicates different C2 IP address.
26

[Cutwail (a.k.a Pandex, Harebot, Pushdo)]
▪

▪

27

Spam Bot▫ It appears 2007 globally (Japan: 2016)▫ This is currently active (more than 10 years)▫ Get email contents and target email address from C2▫ Directly send over SMTP to mail server▫ Two C2 servers are still active
Infection Route▫ Pushdo downloads Cutwail.
▫ Pushdo is delivered as additional payload after Bebloh
or Ursnif.

3.1.1. Cutwail classification
Cutwail-A

Cutwail-B

Operation Period

2007 - Current

2017/09 - Current

Target(2016 - Current)

Japan, Italy, Poland, Germany,
Spain

Only Japan

Infection Volume

10,761 (based on sinkhole observation 2019/03/13 )Delivery Capability
20 million emails per time
(Assumption)
Characteristics
28

Attachment file

300 million emails per time

Mainly URL, Phishing Email(Rarely attachment file)Cutwail-A▪ This malware appeared in 2007.
▪ Main target is Japan.
▫ Italy, Poland, Germany and Spain.
▪ This malware delivers malspam with attachment xls.
▫ Attachment xls leads to download Bebloh in Japan.
▪ Cutwail-A tries to extend its infrastructure.
▫ We confirmed recent malspam campaign which
pretended to be DHL via Ursnif on 29th Jul 2019.
29

Cutwail-B
・ This malware was created for Japan in Sep. 2017
Ursnif-B dropped Cutwail-B at this period.
・ Malspam by Cutwail-B was distributed only to Japan.
・ Email with URLs that lead to download malware
・ Only phishing email for Japan has been observed since Jan. 201930

3.1.1.3. Delivery capability of malspam by Cutwail
Estimate delivery capability by Cutwail based on our observation
Cutwail-A

Cutwail-B

Delivery volume
per one host

5,000 malspams

50,000-60,000

Infected hosts

4,000

6,000

Delivery capability 20 million malspams

31

malspams

300 million malspams<Hypothesis>
Number of Infected hosts from Sinkhole: 10,761 (2019/03/13 Time A and B Total)
Percentage of source hosts of received mail (Cutwail-A : Cutwail-B = 2 : 3)
Thanks @58_158_177_102

3.1.1.4. Classification of delivery method32

3.1. Delivery malspam
Each threat actor has own delivery method.
▪ Group-A▫ Cutwail-A▪ Group-B▫ Web (EK)
▫ Cutwail-A▫ Cutwail-B▫ Compromised Email Account▫ Reply Type▫ Emotet33

3.1.2. Transition of delivery method34

3.1.2.1. Infection by Web(EK)

2016/07〜2017/02▪ Not malspam but also drive-by download attack▪ Web site was compromised by attacker.

35

https://www.lac.co.jp/lacwatch/people/20170523_001291.html

Group-B

3.1.2.2. Cutwail-A▪

Subject

Deceived Invoice email in Japanese▪

Contents

Text in email is also in Japanese andattached zip archive▪

Infection process

Zip archive contains malware

36〜2017/02

Group-A

3.1.2.3. Cutwail-A▪

2017/04〜2017/09

Subject

Deceived Invoice/delivery service email etc.
in Japanese▪

Contents

Text in email is also in Japanese andattached zip archive▪

37

Infection process

Attachments gradually change to zip
archive with js to an xls file with macros

Group-B

3.1.2.4. Cutwail-A▪

Subject

Deceived Invoice email in Japanese▪

Contents

Text in email is also in Japaneseand attached xls with macros▪

Infection process

Macros which was getting more
obfuscated for anti-analysis leadto download Ursnif
38

2017/12〜2019/06

Group-A

3.1.2.5. Cutwail-B▪

2017/10〜2018/12

Subject

Deceived confirmation email from EC sitein Japanese▪

Contents

Malspam was copied original one,this means it’s hard to tell fake email
from real one.
▪
39

Infection process

Malicious URL leads to download Ursnif

Group-B

3.1.2.6. Compromised email account▪

Group-B
2019/04〜2019/07

Subject

Re:, Fw:, Fw:Jin'in sakugen etc.
▪

Contents

One word or two word in email
attached zip or rar archive▪

Infection process

Zip or rar archive contains js or vbs file lead to infect Ursnif.
403.1.2.7. Reply chain
Attached html file as a
replying chain email
Malicious URL in html
downloads zip archive
contains js file leads to Ursnif
infection.

41

This method was observed in
Poland in Aug. 2019.

2019/09

Group-B

3.1.2.8. Emotet
Emotet delivered Ursnif as afollow-up malware.
Ursnif was operated byGroup-B
Target was not changed.
→Group-B utilized a different
delivery route via Emotet.
42

2019/09〜2019/10

Group-B

3.1.3.1. Transition of email subject and contents
Deceived the Invoice

Poor Japanese
expression

Deceived the Invoice

Email deceived EC
This could be copied genuine one.

Change from link toattachment file
Reply chain mail

Relying on Emotet
43

3.1.3.2. Transition of delivery target
Japan, Poland and Italy

Target is Japan,
Poland, Germany, Spain, Italy
New botnet for Japan appeared.
This delivers phishing email.

Actor delivers to Japan withcompromised email account.

Japan, Poland and Germany
Emotet as a delivery Infra
44

Capability
3.1.1 Maldoc analysis
3.1.2 Bebloh analysis
3.1.3 Ursnif analysis

45

3.2.1.1. Transition of attachment file
Attached Xls with macros

Attached zip archived
Bebloh(exe)
URL leads to js

Attached Xls with macros
Got more obfucatedChanged from URL to
attachment file (doc)
Zip archive contains js or vbs

zip (js)

js in doc leads todownload Ursnif

Attachment html file leads
to zip archive contains js file
Via Emotet

46

3.2.1.1. Transition of infection process
InfectBebloh→Ursnif

Infect Bebloh

Infect Ursnif

InfectBebloh→Ursnif

Infect Ursnif
Infect Ursnif
Infect Ursnif

Infect Ursnif
InfectEmotet→Ursnif
47

3.2.1.1. Transition of infection process
Attached zip(exe)(Ursnif)

Attached Xls with macros

Updated Ursnif
version v3

Attached zip archived
Bebloh(exe)
URL leads to js

Changed from URL to
attachment file

Zip archive contains js or vbs
zip (js)48

js in doc leads todownload Ursnif

Attachment html file leads to
zip archive contains js file
Via Emotet

3.2.1.2. Transition of classification by malware infection method49

3.2.1.2. Classification by malware infection method
Group-A
Cutwail-A infected Bebloh with xls attachment
Bebloh infects Ursnif.
Obfuscation and anti-analysis have been enhanced since
October 2018.

Group-B
Attacker infects Ursnif mainly from js using variousdelivery methods.
50

Group-A

3.2.2.Highly obfuscated approach for attachments
4 sophisticated methods for anti-analysis
1. Multi Obfuscations→Multi usage of Invoke-DOSfuscation/Invoke-Obfuscation

2. Steganography→Invoke-PSImage
3. Inject Bebloh into Explorer.exe→Invoke-ReflectivePEInjection
4. Check Execution Environment (only works Japanese environment)
51→Get-Culture
Analysis by @sugimu_sec

Group-A

3.2.2.Highly obfuscated approach for attachments

1. Invoke-Obfuscation52

2. Invoke-PSImage

4. Get-CultureGroup-A

3.2.2.Highly obfuscated approach for attachments

53

Steganography collections

54

Group-AGroup-A

3.2.3 Bebloh analysis

Group-A only utilized bebloh as a downloader of Ursnif
・Geofenced technique for Japan・Not just Ursnif, but Pushdo.
・Detection avoidance of Bebloh and Ursnif
Date
Oct. 2018 – Nov. 2018exe

18th Dec. 2018 – 7th May. 201917th Jun. 2019dll

27th May. 2019 - 5th Jun. 201955

File Typeexe

Infection method
Downloading from URL

Download encrypted Ursnif binary data by XXTEA from
Bebloh's C2 and decrypt on terminal

3.2.4 Ursnif analysis
SerpentKey
CBA16FFC891E31A5

A0511F7C891131A8●

Versionversion=300016
version=300017
version=300018
version=300030
version=300035
version=300036
version=300051
version=300052
version=300054
version=300055
version=300058
version=216996
version=216996
version=216056
version=217068
version=217068
version=217068
version=217068
version=217068
version=217016

BotnetID
id=1000
id=1000
id=1000
id=1000
id=1000
id=1000
id=1000
id=1000
id=1000
id=1000
id=1000
id=201872
id=201810
id=1000
id=1002
id=1010id=1002
id=1000
id=1006
id=201873

urlクエリから分かる設定情報（バージョン、ID）を元に分類する

CBA17F7E892431A1

s4Sc9mDb35Ayj8oO

cvHftGpuqarQFB0D
56

Date
2018/7/2 - 2018/10/24
2018/10/30
2018/11/6
2019/2/18 - 2019/2/20
2019/2/28
2019/4/3
2019/4/23
2019/5/7
2019/5/27
2019/5/30
2019/6/17
2018/7/18
2018/12/11 - 2018/12/28
2019/1/21
2019/4/15 - 2019/5/21
2019/5/22
2019/6/3 - 2019/6/4
2019/6/12 - 2019/6/19
2019/7/16
2018/7/25

soft
soft=1
soft=1
soft=1
soft=1
soft=1
soft=1
soft=1
soft=1
soft=1
soft=1
soft=1
soft=1
soft=1
soft=3soft=1
soft=1
soft=1
soft=1
soft=1
soft=33.2.4 Ursnif analysis

Ursnif-A
id
ver

key
57

Ursnif-B

Group-A

3.2.4 Ursnif analysis

Infect Ursnif-A from Bebloh. SerpentKey was changed occasionally

58

Date

SerpentKey

2016/11 - 2017/02

0WADGyh7SUCs1i2V

2018/03/13-2018/11/06

CBA16FFC891E31A5

2019/01/24-2019/03/06

A0511F7C891131A8

2019/04/23 -CBA17F7E892431A1

We believe that Group-A uniquely developed Ursnif-A for Japan-Compare to other Ursnif, This Ursnif has different config.
-Version number of Ursnif-A is incremented every time malspam wasdelivered3.1.3 Ursnif analysis

Group-B

Infected Dreambot (Ursnif-B) from attachment file
SerpentKey = "s4Sc9mDb35Ayj8oO"
Provided Crime as as Service
We believe Group-B utilized Ursnif-B based on our longterm observation

592.2. Transition of downloaded malware

60Classification of Serpentkey of Ursnif
key=s4Sc9mDb35Ayj8oO

key=CBA16FFC891E31A5

key=A0511F7C891131A8

key=0WADGyh7SUCs1i2V

key=CBA17F7E892431A1
key=s4Sc9mDb35Ayj8oO

key=0123456789ABCDEF

61

key=Gu9foUnsY506KSJ1

3.2.2 Domain analysis
C2 domains from 2015 2017 were registeredspecific email address.

62

Group-A

3.2.2 Domain analysis
Characteristics of C2 domain (2019/5-)
ASN

62088

IP

5.8.88.0/24,
5.188.231.0/24

registerEranet International
LimitedNameServera.dnspod.com

Registrant
Organization

Wang Wiet
MYOB Technology Pty Ltd

63Group-A

3.3 Domain analysis

Group-B

Webhost downloads Ursnif-B has many domains for one IP
address
Group-B used FastFlux infra for Ursnif-b’s C2 domain
This threat actor used to use DarkCloud, now SandiFlux (a.k.a.
BrazzzzersFF)[FastFlux]
IP addresses associated with C2 keep changed in short term
64 https://www.proofpoint.com/us/threat-insight/post/sandiflux-another-fast-flux-infrastructure-used-malware-distribution-emerges

3.4.1. Victims：Number of infected hosts
Ursnif botnet‘s scale
Ursnif-A: 90,000 IP (2016)(*based on sinkhole observation)

Ursnif-B: 45,848 in Japan out of approx 60,000(2019/04 SAS2019)65

Dreambot Business overview 2019: http://benkow.cc/DreambotSAS19.pdf

3.4.1. Victims：Target financial companies
Target list in WebInjectionConfig▪ Group-A
10 domestic banks and common system used by several
domestic banks▪ Group-B
30 domestic banks, 11 credit card companies,
8 cryptocurrency exchanges and 4 other companies
663.5.1. Victims：Transition of WebInjectionConfig
15 banks
11 credit card

13 banks +1

17 banks
11 credit card

18 banks
10 credit card

4 banks

8 banks

16 banks
10 credit card
4 cryptocurrency
exchanges+3 companies
16 banks
9 credit card
4 cryptocurrency
exchanges+3 companies

67

3banks +1

30 banks
9 credit card
8 cryptocurrency
exchanges+4 companies

30 banks
9 credit card
8 cryptocurrency
exchanges+4 companies

3.5.1. Adversary：Target countries■Group-A
Target Countries of Cutwail-A- Japan, Italy, Poland, Swiss and Germany■Group-B
WebInjectionConfig in Ursnif-B- Japan, Poland, Italy and Bulgaria

683.5.1. Adversary
We consider that adversary has an organizational structure.
We are not sure that the strength of the connection
between each role below.

①Cutwail Operator②Maldoc Developer③Malware Developer / Malware User
④Domain Acquirer
69Group-A

3.5.2. Adversary : Group-A
Operation
CutWail
C2

BeblohCutWail

Spam+
Downloader

Manipulation
Server70

Bebloh-C2

Steal
Information①②TA544(NARW Spider) is in charge ofdelivery malspam.

Bank accountCredit card Info

Download
UrsnifBank site etc.
Web Injection

WebConfig

Ursnif-C2③Bebloh and Ursnif partGroup-B

3.5.3. Adversary : Group-B③ Use Dreambot as a service

Operation
CutWail
C2

Link
CutWail

Spam+
Downloader

Steal
Information①Cutwail-B part

Bank accountCredit card Info
Manipulation
Server71

Download
UrsnifBank site etc.

WebConfig

Ursnif-C2

Web Injection④Use BraZZZerS
as a FastFlux service

3.6.1 Transition of actor group/delivery route72

[Transition of actor group/delivery route]73

Group-A

3.6.2. Diamond model analysis

1. Delivery malspam

Spambot
Cutwail-A

・Multi obfuscation
・Usage of Stegano
・Check Environment
Bebloh C2Specific AS

74

Capability

Adversary
Distribution
instructions Deliver target config etc.

Manipulation
Malspamserver・Deceived Invoice
Ursnif C2
・Attached macro xls

Communicate byPowershell

UrsnifVictimCapability
UrsnifActor ID
Ursnif Version/Build etc.

・Checking target environment

VictimVictimAdversary・rarely deliver WebConfig

Infra（Also deliver to Italy and Poland ）2. Ursnif download

Infra

3. Ursnif infection ( delivery webconfig )Adversary TA544

Malspam delivery

Infra

Expected
behavior
Observed
behavior

TA544
Execution
obfuscatedpowershell

Capability
Malspam

4. Fraudulent

remittanceInfra

Adversary*Actually observed until 3.

Fraudulent remittance・Usage of Bebloh

VictimCapability
Ursnif

Web page Injection
For financial
companyGroup-B

3.6.2. Diamond model analysis

1. Delivery malspam

Infra

Adversary

FastFlux

75

Communicate byPowershell
Dreambot

VictimInfra

Capability

Manipulation
Actor ID
serverUrsnifVersion/Buildetc.
Ursnif C2
FastFlux-long domain retainment

Dreambot

VictimVictim・Obfuscation(Easy)

Infra

Capability

Adversary

Observed
behavior
Config for Italy, Poland
and Bulgaria
Deliver target config etc.

Distribution
instructions
Malspam・ Deceived
Rakuten/Bank・doc/js/vbs

Spambot
Cutwail-B

2. Ursnif download

3. Ursnif infection ( delivery webconfig )Adversary

Malspam delivery

Expected
behavior

4. Fraudulent
Execution
obfuscatedpowershell

Capability
MalspamremittanceInfra

Adversary*Actually observed until 3.

Fraudulent remittanceVictimCapability
Ursnif

Web page Injection
For financial
company

4. Active Defense
Not just to defend
A technique for taking a step forward and defending better
Make it harder for threat actor to attack

The Department of Defense defines active defense as: "The
employment of limited offensive action and counterattacks to deny acontested area or position to the enemy.“(US DoD)
https://en.wikipedia.org/wiki/Active_defense
76

4. Active Defense against each Group

77

Actor Method

PeriodResultAB

IoC sharing (Twitter)

2018/06

Stopped for a few month

A,B

Monitoring Cutwail

2018/12

Early warning and sharing

B

Acquired C2 domain by DGA

2018/122019/01

Prevented communication
to C2

B

Sinkhole DGA domain

2019/03

Reduced infected hosts

B

Coordination of compromised
email account2019/05-07 Changed deliver method

A

C2 Domain prediction

2019/05-07 Changed deliver method

4.1. IoC sharing

Group-A
Group-B

Early information sharing against malspam enables eachorganization to block IoCs by analysis.
・Email subject
・Attachment file information
Link information
・Malicious destination
This campaign has been stopped for few month,malspam got sophisticated after break.
78

4.2. Monitoring Cutwail

Group-A
Group-B

・We are monitoring malspam sending operation by
Cutwail in our bot farm.
-Analyzing and decrypting communication protocol to
obtain malspam templates
・The biggest advantage is getting malspam info ASAP.
(e.g. We can identify the all malspam’s subject with samehash value of attached file. )79

4.3. Sinkhole DGA domain

Group-B

Ursnif-B utilized C2 domain by DGA in Dec. 2018.
-Analyzed DGA-Preemptively acquired domains and prevent C2 communication.
-Identification and notification of infected hosts
Campaign has been stopped until Apr. 2019.

80

Group-B

4.4. Coordination of compromised email account・Group-B utilized delivery route via compromised email accounts.
・Extracted source IP from received mail and notified them
Mainly old domestic email accounts were compromised.
・This delivery channel has been retired for several months
due to continual coordination (60 cases).

81

4.5. Forecast for C2 domain

Group-A・Bebloh’S C2 domains have characteristics.
・Predict the domain of C2 and check if this IP is used for C2
before spreading malspam
・Domain prediction enables continuous monitoring of C2
before spreading malspam.
・Sinkhole implementation for Bebloh DGA domain
Malspam campaign targeting Japan stopped since 2019/06
82

4.5 C2 domain analysis

83

Group-A

4.5. Forecast for C2 domain
Observation of C2 response contents
and response time by pseudo Bebloh access

…

N/A

…

Unavailable to download Ursnif…

Available to download Ursnif…

No name resolution…

C2 Down

No response
at night (JST)84

Analysis by @AES256bit

4.5. Forecast for C2 domain

Group-A

Transition of C2 Domains Used in Bebloh DGA

85

Date

TLD by DGA

2018/10 – 11.net, .com

2018/12/18 - 2019/5/07.net, .com

2019/05/27 - 05/30.net, .com

2019/06/05.top, .com

2019/06/17.top, .com

Acquire domain
by DGA

4.6. Result of active defense against Group-A

Group-A

Malspam from Group-A on 2019/6/17 was the last for Japan.
After that, target was changed to Germany, Poland and the US
started, mainly in Italy.

864.6. Trend in delivery from Cutwail-A to Japan

Group-ANo
distribution
to Japan87

4.6. Trend in delivery from Cutwail-A to Japan

88

Group-A

4.6. Result of active defense against Group-B

Group-B・ Changed delivery route to Emotet from 2019/09
Ursnif's WebInjectionConfig via Ursnif-B and Emotet
matches including manipulation server’s information
・Group-B changed malware from Ursnif to Trickbot from
Oct. 2019.
(Target list Ursnif-B and Trickbot have matches.)

・ The attackers have changed their TTPs and still continue totarget Japan.
89

[WebInjectionConfig of Trickbot]

Group-B

Targeted companies in Japan has been added to WebInjectionConfig
since 2019/10/15
Japan accounts for around 30% of the total(rcrd = 1571300200126636 for Japan)

90

[gtag of Trickbot]

Group-B

Trickbot Varies gtag by malware
・ gtag morXX via Emotet
・ gtag leoXX via Ursnif
・ gtag tinXX via IcedID・ gtag onoXX via malspam (zip-lnk-vbs)
・ gtag satXX via malspam (xls)
However, all gtags have the same WebInjetionConfig
The association between the groups of attackers using
Trickbot is unclear.
91

Group-B[Ursnif-B’ activity in late 2019]
Date

Type

Target2019/08-10

Reply type (htm)

Japan, Poland

2019/09-10

As an Emotet follow-up malwareJapan

2019/10-11

Reply type(doc)Germany, Czech Republic

2019/12-doc

Czech Republic, Poland,
Bulgaria*SerpentKey: Gu9foUnsY 506 KSJ1 is also used in the doc
reply type for Germany and Emotet for Japan92

Classification of malspam to Japan93

5. Countermeasure against malspam
・ Don’t allow the mail to send to the mailbox.
・ Implement e-mail security products and leverage IoCs
・ If complomised, find Proxy logs with IoCs
・ Catch malspam information quickly and get IoCs

94

5.1. Application to mail security products
Introduce a mail security product
Monitoring and blocking operation below
・ Email subject
・ E-mail User-Agent・ The IP address of the sender of the mail・ Attachment name・ Attachment extensionex) Unique User-Agent of Cutwail-B
95

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101↵
Thunderbird/45.2.0

5.2. Proxy Protection
Use IoCs (twitter)・ Monitor and block outbound traffic through Proxy.
・ Malware download domains are relatively short-lived
C2 domains are relatively static
Detect Ursnif check-in traffic(domain)/images/(random 150+ strings include /).jpeg# other .avi, .gif, .bmp
96

6. Summary
・The analysis of the e-mail campaign revealed two groups
and their TTPs.
・Analyzing their TTPs can lead to more aggressive defenses.
・ We believe Group-A pulled out of Japan by our active defense.

97[IoCs]

https://docs.google.com/spreadsheets/d/1udcLSbNUzOI2nrPNVIWsL3iUdALAjKHPuoakGPvSu6I/edit?usp=sharing

THANKS!

Any questions?

@bomccss@AIR3_ytakeda @gorimpthon

Work with Community

98@58_158_177_102 @AES256bit @sugimu_sec @wato_dn@hamasho_sec @shokoaraki@tachi4439@catnap707 @autumn_good_35 @Sec_S_Owl@yukitora8@abel1ma

Presentation template by SlidesCarnival@waga_tw@satontonton